Allow showing pending URL for new tab navigations, but only if safe.

content/renderer/render_view_impl.cc

Index: content/renderer/render_view_impl.cc
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index e5740cd4273cefac710c001877646c08a1d3d187..179ae8d75c90cd288d0a29def7be1f9d546fa914 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -2870,6 +2870,13 @@ WebCookieJar* RenderViewImpl::cookieJar(WebFrame* frame) {
   return &cookie_jar_;
 }
 
+void RenderViewImpl::didAccessInitialDocument(WebFrame* frame) {
+  // Notify the browser process that it is no longer safe to show the pending
+  // URL of the main frame, since a URL spoof is now possible.
+  if (!frame->parent() && page_id_ == -1)
+    Send(new ViewHostMsg_DidAccessInitialDocument(routing_id_));
+}
+
 void RenderViewImpl::didCreateFrame(WebFrame* parent, WebFrame* child) {
   Send(new ViewHostMsg_FrameAttached(routing_id_, parent->identifier(),
       child->identifier(), UTF16ToUTF8(child->assignedName())));